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CLAIMS 

What is claimed is: 

1 . A device comprising: 

a graphics rendering engine; and 

a frame buffer memory that is accessible to a user bus, wherein the frame 
buffer memory has a defined secure area and an unsecure area. 

2. The device of Claim 1, wherein access to the secure area is controlled by at least 
one access register defining at least one bound of the secure area. 

3 . The device of Claim 2, wherein the at least one access register may only be 
written if the at least one access register is uninitialized. 

4. The device of Claim 1, further comprising at least one frame buffer reading client 
having an ability to read the secure area and at least one unauthorized reading client 
having an ability to read the unsecure area and lacking an ability to read the secure area. 

5. The device of Claim 2, wherein the at least one access register is a one-time 
programmable register. 

6. The device of Claim 2, wherein the at least one access register is a one-time 
programmable nonvolatile register. 

7. The device of Claim 2, wherein the at least one access register is a one-time 
programmable volatile register. 

8. The device of Claim 4, further comprising a memory controller that receives a 
memory access request from a client of the plurality of reading clients and determines an 
access privilege of the client based on content of a client access privilege register, and 
selects one of at least refusing access and permitting access. 
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9. The device of Claim 4, further comprising if the memory controller selects 
refusing access, the memory controller further selects one of a set consisting of denying 
access, providing of erroneous data, and providing scrambled data. 

5 

10. The device of Claim 1 , further comprising: 

a plurality of writing clients including a set of authorized writing clients having an 
ability to write to the secure area and the unsecure area, and 

a set of unauthorized writing clients having an ability to write to the unsecure area 
io and lacking an ability to write to the secure area. 

11. The device of Claim 1 0, further comprising: 

a memory controller that receives an access request from a client of the plurality 
of clients and 

15 determines an access privilege of the client, and selects one of a set consisting of 

refusing access and permitting access. 

12. The device of Claim 10, wherein: 

each client of the set of authorized writing clients has an access privilege allowing 
20 the client to write to the secure area and the unsecure area, and 

each client of the set of unauthorized writing clients has an access privilege 
allowing the client to write to the unsecure area and prohibiting the client to write to the 
unsecure area. 

25 13. The device of Claim 12, wherein the access privileges are determined by a 
hardware enabling device. 

14. The device of Claim 12, wherein the access privileges are hardwired. 
30 15. The device of Claim 1 2, wherein the access privileges are fusible. 
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16. A graphics processing apparatus comprising: 

a frame buffer memory that is accessible to a user bus; and 

an encryption module operatively coupled to the frame buffer memory, the 

encryption module operative to encrypt data passed to the frame buffer memory 

and decrypting data passing from the frame buffer memory. 

17. The apparatus of Claim 1 6 wherein: 

the data is of a data type having a protection level; 
the encryption module is operative to detect the protection level of the data 
type; and 

the encryption module selectively scrambles data passed to the local 
memory and unscrambling data passing from the local memory according to the 
protection level of the data type. 



1 8. The apparatus of Claim 16 wherein the data has an address within the frame 
buffer memory, wherein the encryption module selectively scrambles data passed to the 
frame buffer memory and unscrambles data passing from the frame buffer memory 
according to whether the address is within a secure range of addresses. 

19. The apparatus of Claim 16 including a plurality of memory access clients, each 
client having an access privilege, wherein the encryption module selectively scrambles 
data passed to the local memory and unscrambles data passing from the frame buffer 
memory according to the access privilege of the client. 
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20. An integrated circuit for an electronic system, the integrated circuit comprising: 

a graphics rendering engine; 

a local frame buffer memory coupled to the graphics rendering engine and 
having a secure area and an unsecure area, the secure area and the unsecure area 
5 being accessible by the graphics rendering engine; and 

a user bus interface coupled to the graphics rendering engine and to the 
local frame buffer memory, the user bus interface operative to couple the 
integrated circuit to a user bus and to provide access of the unsecure area to the 
user bus. 

10 

21. The integrated circuit of Claim 20, wherein access to the secure area is controlled 
by at least one access register defining at least one bound of the secure area. 

22. The integrated circuit of Claim 2 1 , wherein the at least one access register may 
15 only be written if the at least one access register is uninitialized. 

23. The integrated circuit of Claim 20, further comprising a plurality of reading 
clients including a set of authorized reading clients having an ability to read the secure 
area and the unsecure area, and a set of unauthorized reading clients having an ability to 

20 read the unsecure area and lacking an ability to read the secure area. 

24. The integrated circuit of Claim 2 1 , wherein the at least one access register is a 
one-time programmable. 

25 25. The integrated circuit of Claim 24, wherein the at least one access register is a 
one-time programmable nonvolatile register. 

26. The integrated circuit of Claim 23, further comprising a memory access protection 
module that receives an access request from a client of the plurality of clients and 
30 determines an access privilege of the client, and selects one of a set consisting of refusing 
access and permitting access. 
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27. The integrated circuit of Claim 23, further comprising if the memory access 
protection module selects refusing access, the gate keeper module further selects one of a 
set consisting of denying access, providing of erroneous data, and providing scrambled 

5 data. 

28. The integrated circuit of Claim 27, wherein the memory access protection module 
receives an access request from a client of the plurality of clients and determines an 
access privilege of the client, and selects one of a set consisting of refusing access and 

10 permitting access. 

29. The integrated circuit of Claim 28, wherein each client of the set of authorized 
writing clients has an access privilege allowing the client to write to the secure area and 
the unsecure area, and each client of the set of unauthorized writing clients has an access 

1 5 privilege allowing the client to write to the unsecure area and prohibiting the client to 
write to the unsecure area. 

30. The integrated circuit of Claim 29, wherein the access privileges are determined 
by a hardware enabling device. 

20 

3 1 . The integrated circuit of Claim 30, wherein the access privileges are hardwired. 

32. The integrated circuit of Claim 30, wherein the access privileges are fusible. 
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